PrivacyPolicy
Who runs this site
Mayank Tomar — a fullstack web developer based in Madhya Pradesh, India. This is a personal portfolio rather than a company, so there is no data protection officer to route a question through. Everything below is handled by me, and anything you want to ask goes to draft.mayank@gmail.com.
The short version
- This site sets no cookies. Not one — not for analytics, not for anything else. That is also why there is no cookie banner: there is nothing to ask you to agree to.
- Nothing is written to your device. No cookies, no local storage, no fingerprint. Nothing is left behind that could recognise you on your next visit.
- There is no account, no login and no contact form here. Nothing on this site asks you to type anything about yourself.
- Nothing about you is sold, no advertising profile is built, and there is not a single ad or marketing tag on the site.
What is collected
Analytics — cookieless, by design
The site uses Umami to count page views, chosen over Google Analytics precisely because it needs no cookies and no consent prompt. When you open a page your browser sends Umami one request, and this is the whole of it:
| Field | What it holds |
|---|---|
url, hostname | Which page of this site you opened. |
title | That page’s title. |
referrer | The page that linked you here, if any — a search engine, another site, or nothing at all. |
screen | Your screen resolution, e.g. 1920x1080. |
language | Your browser’s language setting, e.g. en-GB. |
website | An ID identifying this site. Not you. |
There is no visitor ID in that list, because there is nowhere to keep one. Umami works out your country and the broad type of browser and device from the IP address and user agent that any request arrives with, and discards the IP rather than storing it. It measures a page, not a person: it tells me an article was read, never who read it.
Server logs — unavoidable, and not mine
The site is hosted on Vercel, and like every web host its network logs the requests it serves: IP address, timestamp, URL, user agent. A server cannot send you a page without knowing where to send it. Those logs are Vercel’s, kept briefly for security and operations, and I do not mine them.
Vercel Analytics — also cookieless
The site also runs Vercel Analytics, which counts page views without cookies and without storing anything on your device either. It cannot follow you between sites and builds no profile.
What is never collected
No names, no email addresses, no messages, no payment details. The contact route on this site is a plain mailto: link — writing to me sends an email through your own provider, and from there I hold it the way anyone holds their inbox.
Cookies
This site sets none. Open your browser’s storage inspector on any page here and you will find it empty: no cookies, no local storage, no session storage, no IndexedDB. If you have grown used to closing a banner on every site you visit, that is why there is nothing to close on this one.
One caveat, in the interest of being exact: the analytics script reads a single local storage key, umami.disabled, and never writes it. It exists so you can switch analytics off for yourself. Run this in your browser’s console and this site stops counting your visits on that browser, permanently:
localStorage.setItem("umami.disabled", "1")Blocking cloud.umami.is works just as well, and any tracker blocker you already run has almost certainly done it for you. Nothing here breaks either way — the analytics is for my curiosity, not for the page to function.
Why, and on what basis
The consent rules people associate with cookie banners — Article 5(3) of the EU’s ePrivacy Directive, and the UK’s equivalent — govern storing or reading information on your device. This site does neither, so there is nothing there to ask you to agree to.
The processing that remains — counting a page view, keeping the site up — rests on legitimate interest (Article 6(1)(f) of the UK and EU GDPR) in knowing which of my writing gets read and in serving the site securely. That is a low bar to clear when the data is aggregate and carries no identifier, and the opt-out above exists for anyone who would rather not be counted at all. Where India’s Digital Personal Data Protection Act, 2023 applies, the same holds.
Who else is involved
- Vercel — hosting, and a second cookieless page-view counter. Sees the requests it serves.
- Umami Software — the analytics above, running on Umami Cloud. Receives one request per page view, holding the fields listed earlier and nothing else. Their handling is covered by the Umami privacy policy.
- X (Twitter) — some pages can embed a post. Where one appears, your browser loads its images from X’s servers, so X sees that request. No post is embedded on a page unless you can see it there.
Articles, project write-ups and the images beside them come from GitHub and jsDelivr, and the listening and repository details come from Spotify, Last.fm and the GitHub API. Every one of those requests is made by the server, using my own accounts, before the page reaches you — your browser never contacts them and they learn nothing about your visit. The typefaces are served from this site rather than fetched from Google Fonts, for the same reason.
Where the data goes
Vercel and Umami both operate internationally, so the little they handle may be processed on servers outside India, the UK and the EEA. Both publish the transfer safeguards they rely on in the policies linked above.
How long it is kept
The analytics is aggregate from the moment it arrives — a count of views against a URL — and I keep it for as long as the site has something to learn from it. No row in it represents you, so there is nothing with a personal expiry date to run down. Vercel’s request logs roll off on their own schedule, typically within a month.
Your rights
Depending on where you live, you have the right to ask what is held about you, to have it corrected or deleted, to object to or restrict its use, and to receive a copy of it.
In practice there is very little here to exercise them against. Without an account, a form or a visitor ID I hold no record that identifies you, and I could not pick your visit out of an analytics report even if you asked me to — which is the point of building it this way rather than promising to be careful with the alternative. What I can do is answer honestly about anything above. Write to draft.mayank@gmail.com and you will have a reply within 30 days. If you are in the EEA or UK you may complain to your local supervisory authority; in India, to the Data Protection Board.
Children
This is a professional portfolio, not a site aimed at children, and nothing on it knowingly collects data from anyone under 18. If you believe a child’s data has reached me somehow, write and it will be removed.
Changes to this policy
This page changes when the site does — a new tool, a new embed. The date at the top is the last time the substance moved. If a change ever meant this site started setting cookies, it would arrive with a banner asking you first, because that is what the law requires the moment the claim at the top of this page stops being true.
Contact
A request, a correction, or a “what exactly does this mean” — draft.mayank@gmail.com.